Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents34 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
glasfloss.com tracker page ↗ | chaosfilter this group | · 1d ago | DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data breach has exposed 402 GB of confidential corporate, financial, and employee records from Glasfloss. The compromised database contains internal documentation across multiple departments: • Accounting & Finance: Contracts, ESOP rec… |
steelhausinc.com tracker page ↗ | chaosfilter this group | · 1d ago | Steelhaus boldly drives the market with innovative energy solutions; fusing practical, field proven experience, adaptable engineering, integrated manufacturing, and uncompromising safety with relentless delivery of unwavering customer service |
mankatoclinic.com tracker page ↗ | chaosfilter this group | · 5d ago | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea… |
artiflexmfg.com tracker page ↗ | chaosfilter this group | · 5d ago | ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica… |
copeplastics.com tracker page ↗ | chaosfilter this group | · 6d ago | Cope Plastics is a leading U.S. distributor and fabricator of performance plastics, serving industrial and commercial customers since 1946. From our headquarters in Alton, Illinois and through multiple branch locations, we support clients across countless sectorsheavy equipment, transportation, aero… |
evergenbio.com tracker page ↗ | chaosfilter this group | · 9d ago | Evergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs |
corematerials.com tracker page ↗ | chaosfilter this group | · 18d ago | Core Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m… |
macallister.com tracker page ↗ | chaosfilter this group | · 18d ago | MacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo… |
singleton.com tracker page ↗ | chaosfilter this group | · 19d ago | Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia. |
parkderochie.com tracker page ↗ | chaosfilter this group | · 21d ago | Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo… |
mswalker.com tracker page ↗ | chaosfilter this group | · 21d ago | MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o… |
copcp.com tracker page ↗ | chaosfilter this group | · 21d ago | Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en… |
tomorrowsoffice.com tracker page ↗ | chaosfilter this group | · Aug 5, 2026 | URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com) Status: Ongoing Data Publication Countdown Security researchers have successfully exfiltrated 125 GB of critical and confidential data from the internal infrastructure of Tomorrow’s Office (tomorrowsoff… |
healthcarehighways.com tracker page ↗ | chaosfilter this group | · Aug 5, 2026 | WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcarehighways.com) Countdown: 24 Hours If corporate representatives do not establish contact via chat within the next 24 hours, a massive internal data cache comprising 235 GB of sensitive company and client records will be p… |
thecranewaregroup.com tracker page ↗ | chaosfilter this group | · Jul 28, 2026 | Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' Data Breach Recent public statements and regulatory filings by UK health-tech firm Craneware claim that the massive cyber-attack they suffered only exposed "non-sensitive or already public regulatory data." They would have the s… |
vit-best.com tracker page ↗ | chaosfilter this group | · Jul 27, 2026 | DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the total data (100%) has been published Countdown: 48 hours until the remaining 97% is published Situation Overview We have successfully breached VIT-BEST’s infrastructure and extracted a complete set of critical data. At this t… |
remco.ca tracker page ↗ | chaosfilter this group | · Jul 26, 2026 | Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry |
neopharmlabs.com tracker page ↗ | chaosfilter this group | · Jul 22, 2026 | Notice of Data Escalation: 3% Proof Publication Management is ignoring the seriousness of the situation and refusing to engage in dialogue. We are publishing a 3% sample of our 627 GB archive right now. We are giving management 48 hours to reach out to us. If they fail to contact us within this ti… |
issvc.com tracker page ↗ | chaosfilter this group | · Jul 22, 2026 | issvc.com Official Notice to Management and Stakeholders The time window has expired. Exactly 24 hours remain until the final deadline. If an agreement is not reached by the end of this period, the complete confidential dataset totaling 262 GB will be published into the public domain. Compromised… |
argonautms.com tracker page ↗ | chaosfilter this group | · Jul 22, 2026 | Target Organization: argonautms.com (Argonaut Manufacturing Services) Status: Unauthorized Access & Data Exfiltration Confirmed Volume: 295 GB of Critical Corporate, Technical & Operational Data Countdown: 48 Hours to establish contact before public release. Executive Summary The internal infras… |
wikoff.com tracker page ↗ | chaosfilter this group | · Jul 20, 2026 | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Data Volume: 650 GB Status: Full Compromise Confirmed We are officially confirming that the entire internal infrastructure of Wikoff Color Corporation—ranging from Board of Directors financial reports and proprietary R&D formulas… |
radiax.com tracker page ↗ | chaosfilter this group | · Jul 16, 2026 | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com. To prove the authenticity of our access, we have published an initial 5% of the total exfiltrated data. This is merely a sample. W… |
sleemanbreweries.ca tracker page ↗ | chaosfilter this group | · Jul 14, 2026 | Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ontario. The company now markets and distributes world-class domestic and imported products. |
spectrumchemical.com tracker page ↗ | chaosfilter this group | · Jul 14, 2026 | Public Notice: Final Ultimatum to Spectrum Chemical Management To the Management of Spectrum Chemical: We have provided you with sufficient time to engage in a productive dialogue regarding the security breach of your infrastructure. Your refusal to communicate and your attempt to ignore the sever… |
aphenapharma.com tracker page ↗ | chaosfilter this group | · Jul 14, 2026 | Aphena Pharma Solutions We have gained full access to your corporate infrastructure. During this operation, we stole 142 GB of your most critical corporate data. The stolen data includes: Financial statements: capital expenditures (CAPEX), fixed assets, accounts receivable and accounts payabl… |
corepharma.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu… |
opportune.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi… |
gisy.com tracker page ↗ | chaosfilter this group | · Jul 6, 2026 | Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (341,712 files) Deadline: 24 Hours We have successfully exfiltrated 1.1 Terabytes of internal data from Global Industries’ (gisy.com) primary network servers. This archive contains comprehensive documentation covering every layer… |
aircreebec.ca tracker page ↗ | chaosfilter this group | · Jul 6, 2026 | Air Creebec, founded in 1982, is a regional airline company based Waskaganish, Quebec. The company provides regular flights, air charter, medical transportation, and cargo services. |
universalplant.com tracker page ↗ | chaosfilter this group | · Jun 30, 2026 | FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive contains highly sensitive information, including: Financial & Accounting: Full audits, tax filings (ADP), payroll, bank transa… |
ingerman.com tracker page ↗ | chaosfilter this group | · Jun 26, 2026 | Ingerman is a developer, builder and manager of multifamily housing communities throughout the Mid-Atlantic region. |
roofdepot.com tracker page ↗ | chaosfilter this group | · Jun 25, 2026 | Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a roofing manufacturer that specializes in roof installation, repairs & replacement |
randa.net tracker page ↗ | chaosfilter this group | · Jun 23, 2026 | Randa Apparel & Accessories is a global powerhouse and one of the world's leading apparel and lifestyle accessories companies, headquartered in New York City at 417 Fifth Avenue, 11th Floor. Founded in 1910, with the founder's family having been in the neckwear business since that time and the curre… |
graymont.com tracker page ↗ | chaosfilter this group | · Jun 22, 2026 | NOTICE: Graymont – Final Warning We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly sensitive data. The scope of our access covers the entire core of your operations, from executive financial strategy to individ… |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.